6780 matches found
CVE-2010-4312
The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie...
Default configuration
The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie...
CVE-2010-4312
CVE-2010-4312 affects Apache Tomcat 6.x; the default configuration omits the HTTPOnly flag in Set-Cookie headers, enabling remote session hijacking via script access to cookies. This vulnerability is tied to the standard Tomcat 6.x deployment and is described as a cookie security flag omission th...
CVE-2010-4312
The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie...
CVE-2010-4304
The web interface in Cisco Unified Videoconferencing UVC System 3545, 5110, 5115, and 5230; Unified Videoconferencing 3527 Primary Rate Interface PRI Gateway; Unified Videoconferencing 3522 Basic Rate Interfaces BRI Gateway; and Unified Videoconferencing 3515 Multipoint Control Unit MCU uses...
Command injection
The web interface in Cisco Unified Videoconferencing UVC System 3545, 5110, 5115, and 5230; Unified Videoconferencing 3527 Primary Rate Interface PRI Gateway; Unified Videoconferencing 3522 Basic Rate Interfaces BRI Gateway; and Unified Videoconferencing 3515 Multipoint Control Unit MCU uses...
CVE-2010-4304
The CVE affects Cisco Unified Videoconferencing (UVC) System components: 3545, 5110, 5115, 5230; 3527 PRI Gateway; 3522 BRI Gateway; and 3515 MCU. Root cause is predictable session IDs based on time values, enabling remote attackers to hijack sessions through brute-force. No exploit details are p...
Cisco Unified Videoconferencing multiple security vulnerabilities
Hardcoded user accounts, command execution, unauthorized access, password storing in reversible encryption, weak permissions, session hijacking, information leaks...
XT:Commerce Cross Site Scripting
---------------------------------------------------------------------------------- Cross-Site-Scripting XT:Commerce alertdocument.cookie and place an order. When the administrator opens the order in the backend of the shop, the javascript will be executed. By getting the cookie of the admin, the...
XT:Commerce 3.04 SP2.1 - Cross-Site Scripting
XT:Commerce 3.04 SP2.1 - Cross-Site Scripting ---------------------------------------------------------------------------------- Cross-Site-Scripting XT:Commerce alertdocument.cookie and place an order. When the administrator opens the order in the backend of the shop, the javascript will be...
FireSheep Fallout: Microsoft Adds HTTPS Option for Hotmail
Three weeks after researchers unveiled a plugin that allows Firefox Web browser users to snoop on the Webmail and social networking sessions of those around them, Microsoft has announced an option that will allow users of its Hotmail Web e-mail program to browse securely. The company said on...
ToorCon: New Apps, Old Infrastructure Make Toxic Brew
In a variety of ways, experts at this weekend’s ToorCon Conference warned that the tidal wave of new devices and Web based services is straining an already aging Internet infrastructure, with privacy and security as the first victims. Call it the ‘schizophrenia of now’: a tidal wave of new...
Plugin, FireSheep, Lays Open Web 2.0 Insecurity
HED: New Tool, FireSheep, Lays Open Web 2.0 Insecurity DEK: The Browser Plug In Offers One Click Session Hijacking for Popular Social Networking Apps. Creators call for better session security. It’s no secret that Web sessions that use the bare HTTP protocol to transmit and receive data are...
NetWin Surgemail XSS vulnerability
Application NetWin Surgemail 4.3e Vendor NetWin - http://netwinsite.com Discovered by Kerem Kocaer [email protected] Problem ------- Cross-site scripting XSS vulnerability in the Surgemail webmail login page /surgemail allows remote attackers to inject arbitrary web script or HTML. Input...
NetWin Surgemail 4.3e Cross Site Scripting
Application NetWin Surgemail 4.3e Vendor NetWin - http://netwinsite.com Discovered by Kerem Kocaer Problem ------- Cross-site scripting XSS vulnerability in the Surgemail webmail login page /surgemail allows remote attackers to inject arbitrary web script or HTML. Input passed to the "usernameex"...
Details Emerge on IE 8 Data-Stealing Bug
Security researcher Chris Evans has released details of the data-stealing bug in Internet Explorer 8 that he publicized earlier this month, saying that the CSS flaw can be used to force victims to post messages on Twitter and that the bug appears to be no closer to being fixed. The bug, which has...
Splunk 4.0.0 - 4.1.4 Multiple Vulnerabilities
Splunk is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:splunk:splunk"; ifdescription...
Splunk Multiple vulnerabilities
This host is running Splunk and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: secpodsplunkmultvuln.nasl 5401 2017-02-23 09:46:07Z teissa $ Splunk Multiple vulnerabilities Authors: Sooraj KS Copyright: Copyright c 2010 SecPod, http://www.secpod.com This program is free...
CVE-2010-3471
CVE-2010-3471 impacts IBM FileNet P8 Application Engine (P8AE) 4.0.2.x, with a vulnerability in the Workplace component that allows session fixation and potential web-session hijacking. The issue is described as affecting all 4.0.2.x prior to 4.0.2.7-P8AE-FP007 and is triggered through unspecifie...